APT38
- ID
- G0082
- Associated names
- NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM
- Source
- attack.mitre.org
- MITRE last modified
- 9 Oct 2026
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext [2] and Banco de Chile [2], along with software supply chain compromises and destructive malware attacks.[1][2][3][4][5][6][7]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Techniques used (115)
- T1005 Data from Local System
- T1012 Query Registry
- T1027.002 Software Packing
- T1027.010 Command Obfuscation
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1033 System Owner/User Discovery
- T1036.003 Rename Legitimate Utilities
- T1036.005 Match Legitimate Resource Name or Location
- T1036.006 Space after Filename
- T1036.008 Masquerade File Type
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1053.003 Cron
- T1053.005 Scheduled Task
- T1053.006 Systemd Timers
- T1055 Process Injection
- T1056.001 Keylogging
- T1056.002 GUI Input Capture
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.002 AppleScript
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1074.001 Local Data Staging
- T1078.003 Local Accounts
- T1078.004 Cloud Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1110 Brute Force
- T1112 Modify Registry
- T1115 Clipboard Data
- T1124 System Time Discovery
- T1132.001 Standard Encoding
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1213.005 Messaging Applications
- T1213.006 Databases
- T1217 Browser Information Discovery
- T1218.001 Compiled HTML File
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1222.002 Linux and Mac Permissions
- T1480 Execution Guardrails
- T1480.002 Mutual Exclusion
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1505.003 Web Shell
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1529 System Shutdown/Reboot
- T1543.001 Launch Agent
- T1543.003 Windows Service
- T1543.004 Launch Daemon
- T1546.016 Installer Packages
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1548.003 Sudo and Sudo Caching
- T1548.006 TCC Manipulation
- T1552.003 Shell History
- T1552.004 Private Keys
- T1553.005 Mark-of-the-Web Bypass
- T1555 Credentials from Password Stores
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1560.001 Archive via Utility
- T1561.002 Disk Structure Wipe
- T1564.003 Hidden Window
- T1564.011 Ignore Process Interrupts
- T1564.012 File/Path Exclusions
- T1565.001 Stored Data Manipulation
- T1565.002 Transmitted Data Manipulation
- T1565.003 Runtime Data Manipulation
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1567 Exfiltration Over Web Service
- T1569.002 Service Execution
- T1571 Non-Standard Port
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1586.003 Cloud Accounts
- T1588.002 Tool
- T1608.001 Upload Malware
- T1620 Reflective Code Loading
- T1657 Financial Theft
- T1677 Poisoned Pipeline Execution
- T1678 Delay Execution
- T1683.001 Written Content
- T1683.002 Audio-Visual Content
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
- T1685.003 Modify or Spoof Tool UI
- T1685.005 Clear Windows Event Logs
- T1686 Disable or Modify System Firewall
- T1686.002 Network Device Firewall
- T1690 Prevent Command History Logging